UID2-7920: Resolve sample image vulnerabilities

.trivyignore

@@ -1,129 +1,2 @@
-# List any vulnerability that are to be accepted
-# See https://aquasecurity.github.io/trivy/v0.35/docs/vulnerability/examples/filter/
-# for more details
-# e.g.
-# CVE-2022-3996
-
-# CVE-2026-1615 — jsonpath (HIGH).
-# Not exploitable here: jsonpath@1.2.1 appears only as a deep transitive of build tooling:
-# react-scripts → react-dev-utils@12 → bfj@7.1.0 → jsonpath@^1.1.1 in both react-client-side
-# package-lock.json files. No app code references it: grep for 'jsonpath'/'bfj' across src/ and
-# server.js in both google-secure-signals and javascript-sdk react-client-side returns nothing.
-# server.js is a plain Express static-file server (require dotenv/fs/path/express only);
-# Dockerfile runs 'npm run build' then 'npm start'=node server.js. bfj/jsonpath execute only
-# during the CRA build, never at runtime, and no attacker-controlled JSON Path expression is
-# ever passed to .query/.nodes/.value/etc.
-# See: UID2-7873
-CVE-2026-1615 exp:2026-12-17
-
-# zlib contrib/untgz demo utility buffer overflow - not exploitable; Alpine does not ship the untgz binary.
-# See: UID2-6704
-CVE-2026-22184 exp:2026-09-09
-
-# GHSA-2p49-hgcm-8545 (HIGH) - svgo removeScripts plugin leaves some executable scripts intact.
-# svgo is build-time-only tooling here: it optimizes the examples' own (trusted) SVG assets at
-# build time and is never run against untrusted input, so it is not reachable at runtime. The
-# app-level svgo (3.x) and postcss-svgo (2.x) could be bumped, but a third copy is svgo 1.3.2
-# bundled inside react-scripts@5's @svgr/webpack@5.5.0, which has NO in-major fix (fixed only in
-# 2.8.3+); forcing it across the major breaks the create-react-app build. Suppressing until
-# react-scripts is upgraded/removed. See: UID2-7555 (fix precedent UID2-6698)
-GHSA-2p49-hgcm-8545 exp:2026-08-23
-
-# CVE-2026-18446 — fast-uri (transitive via ajv) (HIGH).
-# Not exploitable here: react-client-side resolves fast-uri 3.1.4 (prod, via ajv build
-# tooling); client-server & google-secure-signals server-side resolve 3.1.2 dev-only; no direct
-# fast-uri import; sample-app build/dev tooling
-# See: UID2-7633
-CVE-2026-18446 exp:2026-11-06
-
-# CVE-2026-69152 — brace-expansion (npm, transitive via minimatch) (HIGH).
-# Not exploitable here: web-integrations/server-side/package-lock.json:600 brace-
-# expansion@5.0.8 via minimatch@10.2.4 (dev/build tooling); server.js requires only
-# axios/express/cookie-session/ejs/nocache/crypto; no minimatch/glob/brace-expansion on request
-# path
-# See: UID2-7619
-CVE-2026-69152 exp:2026-11-06
-
-# CVE-2026-67213 — nanoid (transitive via postcss) (HIGH).
-# Not exploitable here: nanoid 3.3.16 is a single transitive dep of postcss in both scanned
-# lockfiles (javascript-sdk & google-secure-signals react-client-side). No source imports
-# nanoid or calls customAlphabet/customRandom; postcss uses only the default nanoid() for
-# internal IDs, never the vulnerable custom* functions. postcss runs at CRA build time only.
-# See: UID2-7658
-CVE-2026-67213 exp:2026-11-11
-
-# GHSA-5p4m-2wfm-xmqj — js-yaml (3.15.0 and 4.3.0, transitive npm dependency) (HIGH).
-# Not exploitable here: js-yaml 3.15.0/4.3.0 appear only as dev/build transitives of eslint,
-# react-scripts and @istanbuljs/load-nyc-config in static demo apps (package-lock entries
-# marked dev:true); no source imports js-yaml or calls yaml.load, so no untrusted-YAML runtime
-# path
-# See: UID2-7659
-GHSA-5p4m-2wfm-xmqj exp:2026-11-11
-
-# CVE-2026-73650 — svgo (HIGH).
-# Not exploitable here: svgo appears only in the two scanned react-client-side lockfiles
-# (javascript-sdk & google-secure-signals): svgo@3.3.3 (@svgr/plugin-svgo dep), postcss-svgo's
-# svgo@2.8.1, and svgo@1.3.2 bundled in react-scripts@5/@svgr/webpack@5.5.0. No src/ file
-# imports svgo or calls optimize() (grep in both src trees returned nothing). Dockerfile runs
-# `npm run build` (CRA) then `npm start` -> server.js is plain express serving the static
-# build; svgo runs only at CRA build time on the app's own trusted SVG assets, never against
-# untrusted request input. removeScripts/removeScriptElement plugin is disabled by default and
-# not configured.
-# See: UID2-7707
-CVE-2026-73650 exp:2026-11-18
-
-# CVE-2026-73088 — browserslist (HIGH).
-# Not exploitable here: Both react-client-side apps (javascript-sdk, google-secure-signals) use
-# react-scripts build/start; browserslist is a query array in package.json; no *stats*.json
-# file, no --stats invocation, no opts.stats
-# See: UID2-7802
-CVE-2026-73088 exp:2026-12-02
-
-# CVE-2026-73089 — browserslist (HIGH).
-# Not exploitable here: google-secure-signals lock:5010 browserslist@4.26.3, javascript-sdk
-# lock:4991 browserslist@4.28.0; both are react-scripts@5 CRA apps (build/dev/test scripts).
-# browserslist invoked at webpack/babel build time with fixed 'browserslist' config array; no
-# runtime path accepts attacker-controlled queries.
-# See: UID2-7803
-CVE-2026-73089 exp:2026-12-02
-
-# CVE-2026-75899 — fast-uri (HIGH).
-# Not exploitable here: Flagged lockfiles (google-secure-signals/react-client-side, javascript-
-# sdk/react-client-side) resolve fast-uri 3.1.4 as node_modules/fast-uri declared by ajv
-# (^3.0.1) pulled in by CRA/webpack build tooling; server-side lock resolves 3.1.2 via
-# table>ajv (eslint devtool). Root package.json only lists fast-uri under overrides. No source
-# file imports fast-uri or calls normalize/resolve.
-# See: UID2-7812
-CVE-2026-75899 exp:2026-12-03
-
-# CVE-2026-75931 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 present in react-client-side lock files transitively via
-# ajv (react-scripts/webpack schema-utils); overrides pin in package.json. No source imports of
-# fast-uri/ajv; no fastify. Runtime server.js is a plain Express static file server with no
-# ajv/fast-uri usage and no host-policy resolve() call.
-# See: UID2-7813
-CVE-2026-75931 exp:2026-12-03
-
-# CVE-2026-75975 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 in react-client-side lockfiles (both javascript-sdk and
-# google-secure-signals) solely under ajv; overrides ^3.1.4 in package.json. No source imports
-# fast-uri/ajv. Client-side React example apps; no untrusted-URL normalization before outbound
-# requests.
-# See: UID2-7814
-CVE-2026-75975 exp:2026-12-03
-
-# CVE-2026-76172 — fast-uri (HIGH).
-# Not exploitable here: fast-uri@3.1.4 appears as node_modules/fast-uri under ajv (via ajv-
-# formats, schema-utils, workbox-build) in the react-client-side lockfiles. server.js only
-# requires fs/path/express to serve the static build; no fast-uri/ajv import and no URL
-# resolve/normalize on untrusted input.
-# See: UID2-7815
-CVE-2026-76172 exp:2026-12-03
-
-# js-yaml is only a transitive build-tooling dependency (eslint/react-scripts/test coverage) in the demo apps; not used by served application code
-# See: UID2-7851
-CVE-2026-84375 exp:2026-10-10
-
-# svgo runs only at build time via @svgr/plugin-svgo, postcss-svgo, and CRA's bundled @svgr/webpack, optimizing repo-owned SVGs; each demo app serves only its static build output, no runtime SVG sanitization of user content
-# See: UID2-7852
-CVE-2026-84370 exp:2026-10-10
+# Add accepted vulnerability IDs here with an expiry date and justification.
+# See https://trivy.dev/latest/docs/configuration/filtering/#by-finding-ids

web-integrations/google-secure-signals/client-server/Dockerfile

@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3041
-CMD ["npm", "start"]
+
+USER node
+
+CMD ["node", "server.js"]

web-integrations/google-secure-signals/client-server/package.json

@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -28,7 +28,7 @@
     "picomatch": "^2.3.2",
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
     "fast-uri": ">=3.1.2",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "devDependencies": {

web-integrations/google-secure-signals/react-client-side/Dockerfile

@@ -1,4 +1,4 @@
-FROM node:20.11.0-alpine3.18 AS builder
+FROM node:24.21.0-alpine3.24 AS builder
 
 WORKDIR /usr/src/app
 
@@ -10,7 +10,7 @@ COPY public ./public
 RUN npm run build
 
 
-FROM node:20.11.0-alpine3.18 AS runtime
+FROM node:24.21.0-alpine3.24 AS runtime
 
 WORKDIR /usr/src/app
 
@@ -19,7 +19,8 @@ ENV PORT=3044
 
 COPY package.json package-lock.json ./
 RUN npm ci --omit=dev \
-    && npm cache clean --force
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 COPY --chown=node:node server.js ./
 COPY --from=builder --chown=node:node /usr/src/app/build ./build

web-integrations/google-secure-signals/react-client-side/package.json

@@ -43,7 +43,7 @@
     "shell-quote": "1.9.0",
     "ws": ">=7.5.11",
     "websocket-driver": "^0.7.5",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0",
     "js-yaml@4": "4.3.0"
   },

web-integrations/google-secure-signals/server-side/Dockerfile

@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3043
-CMD ["npm", "start"]
+
+USER node
+
+CMD ["node", "server.js"]

web-integrations/google-secure-signals/server-side/package.json

@@ -9,7 +9,7 @@
     "lint": "eslint server.js"
   },
   "engines": {
-    "node": "20.11.0"
+    "node": "24.21.0"
   },
   "dependencies": {
     "axios": ">=1.18.0",
@@ -30,7 +30,7 @@
     "picomatch": "^2.3.2",
     "@babel/plugin-transform-modules-systemjs": ">=7.29.4",
     "fast-uri": ">=3.1.2",
-    "brace-expansion@5": "5.0.8",
+    "brace-expansion@5": "5.0.9",
     "js-yaml@3": "3.15.0"
   },
   "devDependencies": {

web-integrations/javascript-sdk/client-server/Dockerfile

@@ -1,15 +1,22 @@
-FROM node:20.11.0-alpine3.18
+FROM node:24.21.0-alpine3.24
 
 WORKDIR /usr/src/app
 
 # Copy package files first for better caching
-COPY package*.json ./
-RUN npm install
+ENV NODE_ENV=production
+
+COPY package.json package-lock.json ./
+RUN npm ci --omit=dev \
+    && npm cache clean --force \
+    && rm -rf /usr/local/lib/node_modules/npm /usr/local/bin/npm /usr/local/bin/npx
 
 # Copy application files
-COPY server.js ./
-COPY public ./public/
-COPY views ./views/
+COPY --chown=node:node server.js ./
+COPY --chown=node:node public ./public/
+COPY --chown=node:node views ./views/
 
 EXPOSE 3032
-CMD ["npm", "start"]
+
+USER node
+
+CMD ["node", "server.js"]